systembc | 67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7

General

Target

67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7.exe
Size

381KB
MD5

8be0b78e7331f8376298b9c1f22dd340
SHA1

8af6cfecea6e51d6e92fb7a0b15b095c2cb2475e
SHA256

67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7
SHA512

f6cca3801b883d971bc4af10dbccb1f018084a18c8f71dd5bb14610aacffdda18057340dd4e88e49d681f6f91141b562a9fb8162c994f3ef6fc45207f65af9f8

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

sdadvert197.com:4044

mexstat128.com:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

qtmu.exe

pid process

1392 qtmu.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 api.ipify.org
7 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

pid	process
1392	qtmu.exe

flow	ioc
6	api.ipify.org
7	api.ipify.org

Drops file in Windows directory 2 IoCs

Processes:

67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7.exe

description	ioc	process
File created	C:\Windows\Tasks\qtmu.job	67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7.exe
File opened for modification	C:\Windows\Tasks\qtmu.job	67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7.exe

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1864	5076	WerFault.exe	67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7.exe
4424	1392	WerFault.exe	qtmu.exe
920	1392	WerFault.exe	qtmu.exe
4864	5076	WerFault.exe	67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7.exe
4284	5076	WerFault.exe	67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7.exe
4504	1392	WerFault.exe	qtmu.exe
2296	1392	WerFault.exe	qtmu.exe
444	5076	WerFault.exe	67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7.exe

pid	process
5076	67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7.exe
5076	67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7.exe

C:\Users\Admin\AppData\Local\Temp\67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7.exe
"C:\Users\Admin\AppData\Local\Temp\67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 468
2⤵
- Program crash
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 928
2⤵
- Program crash
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 976
2⤵
- Program crash
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 492
2⤵
- Program crash
PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5076 -ip 5076
1⤵
PID:1196

C:\ProgramData\fvdbxvl\qtmu.exe
C:\ProgramData\fvdbxvl\qtmu.exe start
1⤵
- Executes dropped EXE
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 484
2⤵
- Program crash
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 772
2⤵
- Program crash
PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 868
2⤵
- Program crash
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 720
2⤵
- Program crash
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1392 -ip 1392
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1392 -ip 1392
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5076 -ip 5076
1⤵
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5076 -ip 5076
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1392 -ip 1392
1⤵
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1392 -ip 1392
1⤵
PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5076 -ip 5076
1⤵
PID:2324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Connection Proxy

1

T1090

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Connection Proxy

1

T1090

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\fvdbxvl\qtmu.exe
Filesize
381KB

MD5
8be0b78e7331f8376298b9c1f22dd340

SHA1
8af6cfecea6e51d6e92fb7a0b15b095c2cb2475e

SHA256
67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7

SHA512
f6cca3801b883d971bc4af10dbccb1f018084a18c8f71dd5bb14610aacffdda18057340dd4e88e49d681f6f91141b562a9fb8162c994f3ef6fc45207f65af9f8

Download Submit
C:\ProgramData\fvdbxvl\qtmu.exe
Filesize
381KB

MD5
8be0b78e7331f8376298b9c1f22dd340

SHA1
8af6cfecea6e51d6e92fb7a0b15b095c2cb2475e

SHA256
67473fb1c8ccc03f6415b2a9d2c20ceaa6ad08c867a15cf69d07ea17cf9c98f7

SHA512
f6cca3801b883d971bc4af10dbccb1f018084a18c8f71dd5bb14610aacffdda18057340dd4e88e49d681f6f91141b562a9fb8162c994f3ef6fc45207f65af9f8

Download Submit
memory/1392-136-0x0000000002435000-0x000000000243B000-memory.dmp

Filesize
24KB

Download
memory/1392-137-0x0000000002435000-0x000000000243B000-memory.dmp

Filesize
24KB

Download
memory/1392-138-0x0000000000400000-0x000000000231C000-memory.dmp

Filesize
31.1MB

Download
memory/5076-130-0x00000000025BA000-0x00000000025C1000-memory.dmp

Filesize
28KB

Download
memory/5076-131-0x00000000025BA000-0x00000000025C1000-memory.dmp

Filesize
28KB

Download
memory/5076-132-0x0000000004050000-0x0000000004059000-memory.dmp

Filesize
36KB

Download
memory/5076-133-0x0000000000400000-0x000000000231C000-memory.dmp

Filesize
31.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads